From 135e0c0da20a3a717b3d850f24882b64d0f04af0 Mon Sep 17 00:00:00 2001
From: Shane Maynard <snowspeeder@gmail.com>
Date: Sat, 3 Oct 2026 08:57:16 -0400
Subject: [PATCH] ci: gate deployment on offline chat qualification

---
 .gitea/workflows/rebuild.yml | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/.gitea/workflows/rebuild.yml b/.gitea/workflows/rebuild.yml
index b838cc0..5418b0f 100644
--- a/.gitea/workflows/rebuild.yml
+++ b/.gitea/workflows/rebuild.yml
@@ -9,6 +9,26 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+      - name: Qualify offline account and chat contracts before building or deploying
+        run: |
+          # No NAS, speech SDK, model calls or legacy live-default conftest.
+          # Read-only source mount; test secrets and databases use container /tmp.
+          docker run --rm --user "$(id -u):$(id -g)" \
+            -e HOME=/tmp -e PYTHONDONTWRITEBYTECODE=1 \
+            -v "$PWD:/src:ro" -w /src python:3.12-slim-bookworm \
+            sh -eu -c '
+              python -m venv /tmp/offline-tests
+              /tmp/offline-tests/bin/python -m pip install --no-cache-dir pytest pytest-asyncio -r control/requirements.txt
+              /tmp/offline-tests/bin/python scripts/generate_hope_themes.py --check
+              /tmp/offline-tests/bin/python -m pytest --noconftest -p no:cacheprovider \
+                tests/unit/test_accounts.py tests/unit/test_provisioner.py \
+                tests/unit/test_token_bootstrap.py tests/unit/test_deploy_rollback.py \
+                tests/unit/test_model_preferences_store.py tests/unit/test_model_settings_api.py \
+                tests/unit/test_chat_store.py tests/unit/test_chat_runs.py \
+                tests/unit/test_chat_api.py tests/unit/test_chat_exports.py \
+                tests/unit/test_chat_features.py tests/unit/test_chat_security_review.py \
+                tests/unit/test_chat_cross_client.py -q
+            '
       - name: Build images
         run: |
           docker build -t hope-voice-api-voice:latest .